https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:19:06 +0000 https://cve.radiocsirt.org/vuln/cve-2026-67324 <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython 3.1.50 fails to recognize joined short-option forms such as -u&lt;value&gt; (the short form of --upload-pack=&lt;value&gt;) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u&lt;helper&gt; to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.</p> <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython 3.1.50 fails to recognize joined short-option forms such as -u&lt;value&gt; (the short form of --upload-pack=&lt;value&gt;) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u&lt;helper&gt; to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.</p> https://cve.radiocsirt.org/vuln/cve-2026-67324 https://cve.radiocsirt.org/vuln/ghsa-v396-v7q4-x2qj <p><strong>Affected:</strong> PyPI: GitPython</p> <p>`GitPython` version `3.1.50` blocks unsafe `git clone` options such as `--upload-pack`, `-u`, `--config`, and `-c` unless callers explicitly pass `allow_unsafe_options=True`. However, the default unsafe-option gate does not recognize joined short-option forms such as `-u/path/to/helper`.</p> <p>Git itself accepts `-u&lt;upload-pack&gt;` as the short form of `--upload-pack=&lt;upload-pack&gt;`. As a result, `Repo.clone_from(..., multi_options=[&#34;-u&lt;helper&gt;&#34;], allow_unsafe_options=False)` can execute the helper command even though the equivalent long option is blocked.</p> <p>Affected package:</p> <p>- Ecosystem: PyPI - Package: `GitPython` - Confirmed affected version: `3.1.50` - Repository: `gitpython-developers/GitPython` - Current PyPI version during triage: `3.1.50`</p> <p>Relevant behavior:</p> <p>- `Repo.unsafe_git_clone_options` correctly lists `--upload-pack`, `-u`, `--config`, and `-c` as unsafe clone options. - `Repo._clone()` splits `multi_options` with `shlex.split(&#34; &#34;.join(multi_options))` and then calls `Git.check_unsafe_options(...)`. - `_canonicalize_option_name(&#34;-u/path/to/helper&#34;)` returns a string beginning with `u...`, not the canonical short option `u`, so it does not match the blocked `-u` entry. - Git accepts the same joined short option as `--upload-pack=&lt;helper&gt;` and executes the helper during clone.</p> <p>Preconditions:</p> <p>An application must pass attacker-influenced clone options into `Repo.clone_from(..., multi_options=...)` while relying on GitPython&#39;s default unsafe-option gate to block command-…</p> <p><strong>Affected:</strong> PyPI: GitPython</p> <p>`GitPython` version `3.1.50` blocks unsafe `git clone` options such as `--upload-pack`, `-u`, `--config`, and `-c` unless callers explicitly pass `allow_unsafe_options=True`. However, the default unsafe-option gate does not recognize joined short-option forms such as `-u/path/to/helper`.</p> <p>Git itself accepts `-u&lt;upload-pack&gt;` as the short form of `--upload-pack=&lt;upload-pack&gt;`. As a result, `Repo.clone_from(..., multi_options=[&#34;-u&lt;helper&gt;&#34;], allow_unsafe_options=False)` can execute the helper command even though the equivalent long option is blocked.</p> <p>Affected package:</p> <p>- Ecosystem: PyPI - Package: `GitPython` - Confirmed affected version: `3.1.50` - Repository: `gitpython-developers/GitPython` - Current PyPI version during triage: `3.1.50`</p> <p>Relevant behavior:</p> <p>- `Repo.unsafe_git_clone_options` correctly lists `--upload-pack`, `-u`, `--config`, and `-c` as unsafe clone options. - `Repo._clone()` splits `multi_options` with `shlex.split(&#34; &#34;.join(multi_options))` and then calls `Git.check_unsafe_options(...)`. - `_canonicalize_option_name(&#34;-u/path/to/helper&#34;)` returns a string beginning with `u...`, not the canonical short option `u`, so it does not match the blocked `-u` entry. - Git accepts the same joined short option as `--upload-pack=&lt;helper&gt;` and executes the helper during clone.</p> <p>Preconditions:</p> <p>An application must pass attacker-influenced clone options into `Repo.clone_from(..., multi_options=...)` while relying on GitPython&#39;s default unsafe-option gate to block command-…</p> https://cve.radiocsirt.org/vuln/ghsa-v396-v7q4-x2qj https://cve.radiocsirt.org/vuln/pysec-2026-3947 <p><strong>Affected:</strong> PyPI: gitpython</p> <p>GitPython 3.1.50 fails to recognize joined short-option forms such as -u&lt;value&gt; (the short form of --upload-pack=&lt;value&gt;) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u&lt;helper&gt; to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.</p> <p><strong>Affected:</strong> PyPI: gitpython</p> <p>GitPython 3.1.50 fails to recognize joined short-option forms such as -u&lt;value&gt; (the short form of --upload-pack=&lt;value&gt;) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u&lt;helper&gt; to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.</p> https://cve.radiocsirt.org/vuln/pysec-2026-3947